CrowdStrike investigates FalconFlank privilege escalation report

Nightmare Eclipse released FalconFlank and said it was a zero-day privilege-escalation exploit for CrowdStrike Falcon. The researcher said it worked on current Windows 11 25H2 and Windows Server 2025 systems and could let an attacker gain SYSTEM access by abusing Falcon's remediation feature for malicious Office macros.

When BleepingComputer asked CrowdStrike for more detail, a spokesperson said the company was investigating the claims. The spokesperson advised customers to disable the Microsoft Office Windows policy setting that controls File Suspicious Macro Removal, said customers still had protection through Cloud Anti-malware for Microsoft Office Files, and pointed readers to a FalconFlank tech alert that was only available through CrowdStrike's support portal.

This week Nightmare Eclipse also released privilege-escalation exploits for Kaspersky Antivirus for Endpoint and GenDigital's Avast Antivirus, together with a denial-of-service exploit for Nvidia called GreenSection. Kevin Beaumont said on Thursday that the privilege-escalation exploits released this week were real and worked.

Nightmare Eclipse had also disclosed several Microsoft zero-days since April, covering Microsoft Defender, BitLocker and other Windows components. Microsoft said after the first disclosures that it might take legal action against people involved in malicious activity that harmed customers, and some of the named flaws had since been fixed while others still awaited patches.